MOBILE COLLECTION UNIT

LunchBox Workstations

Our lunch box work stations are rugged, portable computers designed for our investigators who require workstation performance and expandability on the go. These workstations are built by our team and customized with specific hardware and software to handle any type of situation. They provide integrated, portable systems ready to be deployed on the client's site. We primarily use these computers for eDiscovery collections and incident response cases.

We make use of these lunch box workstations primarily because of power, speed, and storage capacity. Unlike any laptop, these workstations are powerful enough to run enterprise-class computer forensic software and have the ability to hold up to 20TB worth of data.

With these workstations, we can collect live-state analyses of servers, workstations, laptops, and networks over the wire. They can collect data from SAN and NAS units in a continuous stream over the network or via direct attachment through a crossover wire.

These devices utilize two powerful forensic tools to accomplish their tasks:

ProDiscover Incident Response enables us to quickly and thoroughly examine a live system operating anywhere on a network. When used as a part of an incident response procedure or as part of a routine audit, ProDiscover IR enables us to determine if that system has been compromised, and allows us to gather evidence that is needed. ProDiscover IR utilizes an agent that runs on the suspect system to read the disk at the bit level. This enables IR to work around the suspect system's OS and examines all the files, even if they are hidden by Trojans or any malicious content.

We utilize the EnCase Enterprise platform, a program used by numerous government agencies, more than 65 percent of the Fortune 100, and more than 40 percent of the Fortune 500, to conduct digital investigations of servers, laptops, desktops, and mobile devices. EnCase Enterprise works by combining five components (the Examiner, the SAFE, the Servlet, the Enterprise Connection, and the incident response capability (Snapshot) into one overall system that delivers an enterprise-class, investigative infrastructure. This single tool integrates seamlessly with your existing systems to give us immediate access to comprehensive information on computers across the entire network in a secure fashion. In addition to complete network transparency, EnCase Enterprise also enables us to remediate any security event as it is identified.